KOALA Project Report 2 Arxiv:1809.10944V1 [Cs.HC]

Are Children Well-Supported by Their Parents Concerning Online Privacy Risks, and Who Supports the Parents? — KOALA Project Report 2 Jun Zhao Department of Computer Science University of Oxford arXiv:1809.10944v1 [cs.HC] 28 Sep 2018 April 28, 2018 1 KOALA Project Report 2 April 2018 Executive Summary Tablet computers are becoming ubiquitously available at home or school for young children to complement education or entertainment. However, parents of children aged 6-11 often believe that children are too young to face or comprehend online privacy issues, and often take a protective approach to restrict or monitor what children can access online, instead of discussing privacy issues with children. Parents work hard to protect their children’s online safety. However, little is known how much parents are aware of the risks associated with the implicit personal data collection by the first- or third-party companies behind the mobile ‘apps’ used by their children, and hence how well parents can safeguard their children from this kind of risks. Parents have always been playing a pivotal role in mitigating children’s interactions with digital technologies — from TV to game consoles, to personal computers — but the rapidly changing technologies are posing challenges for parents to keep up with. There is a pressing need to understand how much parents are aware of privacy risks concerning the use of tablets and how they are managing them for their primary school-aged young children. At the same time, we must also reach out to the children themselves, who are on the frontline of these technologies, to learn how capable they are to recognise risks and how well they are supported by their parents to cope with these risks. Therefore, in the summer of 2017, we conducted face-to-face interviews with 12 families in Oxfordshire and an online survey with 250 parents. This report summarises our key findings of these two studies. Three key findings 1. Parents commonly associated privacy risks with access to the Internet, exposure to inap- propriate content, in-app adverts, or strangers. However, their knowledge of personal data collected by mobile apps is low. 2. Parents often think their children are too young to understand privacy risks online and delay these conversations with their children. As a result, children often rely on their parents’ guidance to cope with unknown risks, and they not always capable of recognising personal privacy-related risks. 3. When children do seek help from their parents, parents do not necessarily fully understand the risks themselves. Existing privacy safeguarding technologies mainly focus on enabling content control and offer little choices for raising parents’ awareness of personal data collection risks or supporting their children’s learning. These findings provide critical input for us to consider providing better support for parents to scaffold their children’s ability of recognising and coping with online privacy risks, particularly those associated with implicit personal data tracking. — KOALA Project Report 2 Page 1 KOALA Project Report 2 April 2018 1 Introduction Tablet computers are widely used to complement education and provide entertainment at home and school. In the UK, 44% of children aged between 5 to 11 have their own tablet computers or use them as the major means to go online [35]. Tablet computers are used in over 70% of UK schools to complement education. A similar trend is also observed in the US, where ownership of tablets by young children has grown 5 times between 2011 and 2013 [1]. This is transforming the learning experience for young children [17, 36, 32, 38]. However, these new ways of online access pose new privacy risks to families and young children. The large number of applications (‘apps’) that can be downloaded for free are a major way in which children interact with these devices. Currently these ‘free’ apps are largely supported by monetisation of user’s personal information [2, 22]. While the use of cute characters may suggest benign practices, a large amount of personal information and online behaviour may be collected from children’s apps and shared with third party online marketing and advertising industry [37]. Such practices are not unique to children’s apps, but young children are particularly vulnerable to this type of exposure and less capable to resist the resulting (personalised) in-app advertisements and game promotions [19]. Previous work [51, 21] have discussed different types of online privacy threats that are recognisable by young children interacting with mobile devices, but personal data collection by mobile apps has not been specifically discussed. Exiting research has shown that this opaque data privacy risk is unknown to most users and extremely challenging to manage [46, 44]. Current internet safeguarding advice for young children mainly focuses on the management of content, cyberbullying or social media [19]. We argue that approaches to raising young children’s awareness of data privacy risk are under-researched, yet are critical for scaffolding children’s mental models of privacy. Our work thus focuses on understanding the current practices applied by parents for safeguarding the online privacy of their children, and identifying barriers faced by families for mediating data privacy risks effectively. We aim to explore three questions: • What privacy risks are children aged 6-10 aware of when interacting with their tablets? • How much are parents aware of the possibility of personal data collection by the apps regularly used by their children? • What technical and social practices are used by parents for safeguarding their young children’s online privacy, and what support do they need to mediate data privacy risks? To achieve this, we conducted semi-structured interviews with 12 parent-child pairs from the South East area of the UK, complemented by an online survey with 220 parents from western developed countries (78.6% UK residence). Our analysis shows that current privacy tools on tablet devices provide good support for parents in our study to set up basic content control and filtering, but offer only limited capabilities for supporting them to gain awareness of data privacy risks or help their children establish this understanding. Although savvy tablet users, children in our study did not demonstrate a consistent understanding of their risk coping actions. Similarly, their parents – who are largely relied upon by young children – had limited awareness of the implicit personal data collection by third-parties or how to safeguard their children from this kind of risks. Our findings suggest that we are in need of new tools to raise parents’ awareness of the current personal data collection practices of mobile applications, and help both parents and young children to gain the skills for coping with data privacy threats on mobile platforms. — KOALA Project Report 2 Page 2 KOALA Project Report 2 April 2018 2 Background 2.1 Children and Mobile Technology In 2016, UK children aged 5-15 were for the first time reported to spend more time online than watching TV [35]. Tablets and smartphones are becoming the most popular devices used by children to go online, overtaking laptops or computers. However, little is known about the impact of these technologies on children’s online safety and general well-being [19]. Research has shown that teenagers and tweens have a reasonable understanding about privacy risks online and their implications, and strategies to protect themselves [11, 31], although they are fac- ing increasing challenges related to the use of Social Media platforms and smartphone devices [48]. However, younger children are generally expected to be less capable to engage with the Internet in a safe and mindful way [41, 16]. Using hypothetical scenarios and the contextual integrity frame- work, Kumar et al. [21] unpacked young children’s (aged 5-11) understandings of online privacy and identified key gaps in their recognition of how information is transmitted from/to their devices. Zhang- Kenney et al. [51] found that children aged 7-11 perceived privacy related to their use of mobile devices as being alone, hiding secrets, keeping things to yourself, or not talking to strangers, largely drawing on their offline life experiences. We extend this existing body of work and examine children’s understanding about data privacy on the mobile platforms in a contextualised and nuanced way. 2.2 Parental Mediation of Mobile Technology Researchers have found that parents are generally concerned about their children’s online privacy risks [35, 51], and employ a range of mechanisms in an attempt to safeguard their children, such as password protections, supervising them, or setting up social practices at home (e.g. limiting access to the Internet) [35]. Our work aims to investigate whether UK parents of young children are effectively supported to choose less privacy-invasive mobile apps for their children and what parents may struggle with. A large body of previous research has investigated parents’ role in regulating their children’s’ interactions with technologies, such as TV or computers [25, 5, 43, 29, 42, 40]. Parents’ role in mediating children’s usage of the new mobile technologies are largely investigated for parents of older children [48, 49] or parents battling with young children’s screentime control [15, 14] or content filtering [13]. These studies highlighted the challenges that parents face with fully grasping the new technologies or socially engaging their young children. Literature suggests that parents’ engagement largely falls into three patterns [14]: active mediation, where parents take time to discuss with children about usage of technologies [28]; restrictive mediation, where access to technologies is controlled and limited; and co-engagement, where parents con- sume technologies together with their children without injecting any critiques [13]. Existing parental mediation approaches for managing older children’s online privacy and safety have largely focused on a restriction approach, for example, controlling or monitoring teens’ interaction with their mobile phones using parental control software.

Load more